agent-relay-orchestrator 0.127.8 → 0.127.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.127.8",
+  "version": "0.127.9",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "agent-relay-providers": "0.104.4",
-    "agent-relay-sdk": "0.2.121",
+    "agent-relay-sdk": "0.2.122",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/src/workspace-probe/integrated-land-gates.ts

@@ -1,12 +1,28 @@
-import { mkdtempSync, rmSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { errMessage } from "agent-relay-sdk";
+import type { LandGate } from "agent-relay-sdk";
 import { git } from "../git";
 import { runLandGates, type LandGatesResult } from "./land-gates-runner";
 import { mergePhaseTimeoutMs, withMergePhaseTimeout } from "./merge-timeouts";
 
 const LAND_COMMITTER = { name: "Agent Relay", email: "agent-relay@noreply" } as const;
+const FULL_CI_LAND_GATE: LandGate = {
+  name: "ci-land-full",
+  command: "AGENT_RELAY_CI_LAND_FULL=1 bun run ci:land",
+  timeoutMs: 30 * 60 * 1000,
+};
+const DEPENDENCY_LINK_PATHS = [
+  "node_modules",
+  "dashboard/node_modules",
+  "sdk/node_modules",
+  "runner/node_modules",
+  "orchestrator/node_modules",
+  "codex/node_modules",
+  "claude/node_modules",
+  "client/node_modules",
+] as const;
 
 // Synthesize, but do not advance any ref to, the no-ff merge commit of branchSha
 // into baseSha. The resulting commit/tree is the exact integrated tree that will
@@ -32,12 +48,40 @@ export async function synthesizeNoFfMerge(
   return { ok: true, mergeSha: commit.stdout };
 }
 
+async function baseDeclaresCiLand(repoRoot: string, baseSha: string, signal?: AbortSignal): Promise<boolean> {
+  const pkg = await git(["show", `${baseSha}:package.json`], repoRoot, { timeoutMs: mergePhaseTimeoutMs("gates"), timeoutLabel: "workspace merge inspect base package scripts", signal });
+  if (!pkg.ok || !pkg.stdout) return false;
+  try {
+    const parsed = JSON.parse(pkg.stdout) as { scripts?: Record<string, unknown> };
+    return typeof parsed.scripts?.["ci:land"] === "string";
+  } catch {
+    return false;
+  }
+}
+
+function linkDependencyDirs(sourceWorktree: string, gateWorktree: string): void {
+  for (const rel of DEPENDENCY_LINK_PATHS) {
+    const from = join(sourceWorktree, rel);
+    const to = join(gateWorktree, rel);
+    if (!existsSync(from) || existsSync(to)) continue;
+    try {
+      const stat = lstatSync(from);
+      if (!stat.isDirectory() && !stat.isSymbolicLink()) continue;
+      mkdirSync(join(to, ".."), { recursive: true });
+      symlinkSync(realpathSync(from), to, "dir");
+    } catch (err) {
+      console.error(`[orchestrator] land-gate dependency link skipped ${rel}: ${errMessage(err)}`);
+    }
+  }
+}
+
 /**
  * Run land gates against the exact tree that would land.
  *
- * - behind === 0: the landing worktree HEAD already is that tree, so run in place.
- * - behind  >  0: synthesize the no-ff merge commit without moving a ref, materialize
- *   it in a detached temp worktree, and gate that integrated tree.
+ * Always materializes that tree in a detached checkout. Even a fast-forwardable
+ * branch is gated outside the worker worktree so worker-only topology, untracked
+ * files, and symlink layout cannot make the boundary check pass differently than
+ * the tree that will advance the base ref.
  */
 export async function runLandGatesOnIntegratedTree(
   repoRoot: string,
@@ -49,30 +93,32 @@ export async function runLandGatesOnIntegratedTree(
   signal?: AbortSignal,
 ): Promise<{ gates: LandGatesResult } | { abort: { conflict?: boolean; error: string } }> {
   console.error("[orchestrator] workspace.merge gate-start worktree=" + worktreePath + " behind=" + behind);
-  if (behind === 0) {
-    return { gates: await withMergePhaseTimeout("gates", () => runLandGates(worktreePath), { signal }) };
-  }
 
-  let synth: Awaited<ReturnType<typeof synthesizeNoFfMerge>>;
-  try {
-    synth = await withMergePhaseTimeout(
-      "synthesize",
-      (phaseSignal) => synthesizeNoFfMerge(repoRoot, integrationBaseSha, headSha, mergeMessage, mergePhaseTimeoutMs("synthesize"), phaseSignal),
-      { signal },
-    );
-  } catch (err) {
-    return { abort: { error: errMessage(err) } };
+  const requiredGates: LandGate[] = await baseDeclaresCiLand(repoRoot, integrationBaseSha, signal) ? [FULL_CI_LAND_GATE] : [];
+  let gateRef = headSha;
+  if (behind > 0) {
+    let synth: Awaited<ReturnType<typeof synthesizeNoFfMerge>>;
+    try {
+      synth = await withMergePhaseTimeout(
+        "synthesize",
+        (phaseSignal) => synthesizeNoFfMerge(repoRoot, integrationBaseSha, headSha, mergeMessage, mergePhaseTimeoutMs("synthesize"), phaseSignal),
+        { signal },
+      );
+    } catch (err) {
+      return { abort: { error: errMessage(err) } };
+    }
+    if (!synth.ok) return { abort: { conflict: synth.conflict, error: synth.error } };
+    gateRef = synth.mergeSha;
   }
-  if (!synth.ok) return { abort: { conflict: synth.conflict, error: synth.error } };
 
   const tmpParent = mkdtempSync(join(tmpdir(), "agent-relay-landgate-"));
-  const tmpWorktree = join(tmpParent, "tree");
+  const tmpWorktree = join(tmpParent, "checkout");
   let add: Awaited<ReturnType<typeof git>>;
   try {
     add = await withMergePhaseTimeout(
       "worktree-add",
       (phaseSignal) => git(
-        ["worktree", "add", "--detach", tmpWorktree, synth.mergeSha],
+        ["worktree", "add", "--detach", tmpWorktree, gateRef],
         repoRoot,
         { timeoutMs: mergePhaseTimeoutMs("worktree-add"), timeoutLabel: "workspace merge land-gate worktree add", signal: phaseSignal },
       ),
@@ -88,7 +134,8 @@ export async function runLandGatesOnIntegratedTree(
   }
 
   try {
-    return { gates: await withMergePhaseTimeout("gates", () => runLandGates(tmpWorktree), { signal }) };
+    linkDependencyDirs(worktreePath, tmpWorktree);
+    return { gates: await withMergePhaseTimeout("gates", () => runLandGates(tmpWorktree, requiredGates), { signal }) };
   } finally {
     try {
       await withMergePhaseTimeout(

package/src/workspace-probe/land-gates-runner.ts

@@ -3,15 +3,13 @@ import { errMessage } from "agent-relay-sdk";
 import type { LandGate, LandGateRunResult } from "agent-relay-sdk";
 import { loadRepoLandGates } from "agent-relay-sdk/land-gates";
 
-// #902 — execute a repo's configured land gates against the candidate merged tree
-// inside the landing worktree, BEFORE the ref advance in `mergeRebaseFf`. A repo
-// with no `.agent-relay/land-gates.json` loads zero gates, so the caller takes the
-// exact unchanged land path (ironclad opt-in / zero regression). A required gate
-// failing blocks the land (ref NOT advanced); optional gates only warn.
-
-/** Per-gate default timeout when the gate didn't declare `timeoutMs`. Land gates
- *  are meant to be a FAST high-signal subset, not the full suite — keep the ceiling
- *  generous but bounded so a hung gate can't wedge the per-repo merge lease forever. */
+// #902/#1199 — execute mandatory boundary gates and any repo-configured land gates
+// against the candidate merged tree BEFORE the ref advance in `mergeRebaseFf`.
+// A required gate failing blocks the land (ref NOT advanced); optional gates only warn.
+
+/** Per-gate default timeout when the gate didn't declare `timeoutMs`. Keep the
+ *  ceiling generous but bounded so a hung gate can't wedge the per-repo merge
+ *  lease forever. Full-suite boundary gates should declare their own timeout. */
 const DEFAULT_GATE_TIMEOUT_MS = 5 * 60 * 1000;
 const TIMEOUT_KILL_GRACE_MS = 1_000;
 const OUTPUT_CANCEL_GRACE_MS = 50;
@@ -189,21 +187,20 @@ export interface LandGatesResult {
 }
 
 /**
- * Load + run the repo's configured land gates against `worktreePath`. Returns
- * `ran: 0` with no failure/warnings when the repo declares no gates — the load is the
- * ONLY thing that runs in that case (a missing file → empty list, no subprocess), so
- * the opt-in is byte-clean. Stops at the first failing REQUIRED gate (it blocks the
- * land); optional failures accumulate as warnings and never block.
+ * Load + run required boundary gates plus the repo's configured land gates against `worktreePath`.
+ * Returns `ran: 0` with no failure/warnings only when neither the boundary nor the repo
+ * declares gates. Stops at the first failing REQUIRED gate (it blocks the land);
+ * optional failures accumulate as warnings and never block.
  *
  * A PRESENT-but-malformed `.agent-relay/land-gates.json` is itself a blocking failure
  * (surfaced as a synthetic required gate) rather than an unhandled throw that would
  * crash the merge command — the worker fixes the config and re-lands.
  */
-export async function runLandGates(worktreePath: string): Promise<LandGatesResult> {
+export async function runLandGates(worktreePath: string, requiredGates: LandGate[] = []): Promise<LandGatesResult> {
   const warnings: LandGateRunResult[] = [];
   let gates: LandGate[];
   try {
-    gates = loadRepoLandGates(worktreePath);
+    gates = [...requiredGates, ...loadRepoLandGates(worktreePath)];
   } catch (err) {
     const output = `invalid .agent-relay/land-gates.json: ${errMessage(err)}`;
     return {

package/src/workspace-probe/merge-timeouts.ts

@@ -1,12 +1,12 @@
 export type MergePhase = "total" | "prep" | "preview" | "fetch" | "rebase" | "gates" | "synthesize" | "worktree-add" | "cleanup";
 
 const MERGE_PHASE_TIMEOUTS_MS: Record<MergePhase, number> = {
-  total: 10 * 60_000,
+  total: 40 * 60_000,
   prep: 60_000,
   preview: 30_000,
   fetch: 60_000,
   rebase: 60_000,
-  gates: 5 * 60_000,
+  gates: 35 * 60_000,
   synthesize: 60_000,
   "worktree-add": 60_000,
   cleanup: 30_000,